Securing Ubuntu Server: A Practical Approach for Protecting Containers and Deployments

There are a couple of helpful approaches that you can use to secure the Ubuntu server. That’s why, we decided to share some practical recommendations relating to this topic.

Just by checking your logwatch, you can detect how many attempts of entering your system occurred and which are they. In the general overview that we are going to share in the article, we will share some details of locking down servers for use as Docker hosts.

Initial Setup Steps

The most initial and at the same time crucial step is the choice of the password for the root user. Here, you need to select something more complex and a PW generator can be a good choice for such situations. With the help of the password generator, you can save the needed password automatically in only a couple of seconds and additionally encrypt it with the master PW. Whatever tool you are using for password generation, you should also think about some other form of encryption. The root password might be necessary in case you have some issues with the sudo password.

Another important step is upgrading and updating to have the latest patches on the system. Here is how you can do it:

apt-get update
apt-get upgrade

Creating a New User

One more important thing that you should follow for security reasons is never login on the server as root. For instance, in a small team of users, one login can be used for the simplifying of the process and still be secure. With more users in the team, the most appropriate choice is to give certain permissions for and only with sudo access.

# Create the 'deploy' user
useradd deploy
# Create the home directory for the 'deploy' user
mkdir -p /home/deploy
# Create the '.ssh' directory inside the 'deploy' user's home directory
mkdir -p /home/deploy/.ssh
# Set the appropriate permissions for the '.ssh' directory
chmod 700 /home/deploy/.ssh
# Optionally, change ownership of the home and '.ssh' directory to the 'deploy' user
chown -R deploy:deploy /home/deploy

The next step is setting up the necessary shell with:

usermod -s /bin/bash deploy 

Enable SSH Key Authentication

Another good recommendation is to avoid passwords for entering the servers. Here are a couple of points regarding this topic:

• SSH keys are almost impossible to guess that’s why you cannot access the system with brute-force attacks as with regular passwords.
• Keys are also better than regular passwords just because they require more information.
• In case of a missing device or even stolen, you can safeguard your key by removing the public key from authorized_keys. You can also get an additional layer of protection by using the long passphrase.
• The importance of a secure passphrase is crucial.

Now let’s copy id_rsa.pub1:

vim /home/deploy/.ssh/authorized_keys  

Here is how the right permissions should be set up:

chmod 400 /home/deploy/.ssh/authorized_keys

chown deploy:deploy /home/deploy -R

Verify Deploy User and Configure Sudo

During this process, we will leave the SSH connection as root and we will try to verify the deploy user. Then we will set a password for deploy. To create a more secure password, we will use a specific manager which will also add some level of encryption.

passwd deploy

Then open sudo with:

visudo

Now, we will add sudo group below the root user:

root ALL=(ALL) ALL

%sudo   ALL=(ALL:ALL) ALL

Add deploy use with:

usermod -aG sudo deploy

After these steps, the deploy user gets sudo permissions. Now, you can either relogin to the shell or use the following command to access these permissions:

exec su -l deploy

Restrict Logins to SSH Keys

The configuration is here:

vim /etc/ssh/sshd_config

In the file, you will need to add IP, the following command is rather straightforward, you should be connected to your VPN and authenticated as follows:

PermitRootLogin no

PasswordAuthentication no

AllowUsers deploy@(your-VPN-or-static-IP)

Then you will need to restart the SSH service:

service ssh restart

Configuring a Firewall

The firewall configuration can be done with Iptables or you may use a simplified option on the top of Iptables that is ufw. On the Ubuntu system, ufw is installed according to the default whereas on the Debian system – it should be additionally installed with:

apt-get install ufw

Start with opening the config file:

vim /etc/default/ufw

Change the following value to yes:

IPV6=yes

Now, you can set everything up from the command line with ufw as follows:

sudo ufw allow from {specify-the-ip} to any port 22

sudo ufw allow 80

sudo ufw allow 443

sudo ufw disable

sudo ufw enable

Prior to setting up these rules, you should definitely have a static IP. This factor is crucial because a dynamic IP can leave you locked out.

Automating Security Updates

Automation is very important, otherwise, you can just miss some security updates in your system. Here are some steps to follow for the improvement of the security:

apt-get install unattended-upgrades

vim /etc/apt/apt.conf.d/10periodic

Make some updates to the file as here:

APT::Periodic::Update-Package-Lists "2";

APT::Periodic::Download-Upgradeable-Packages "2";

APT::Periodic::AutocleanInterval "14";

APT::Periodic::Unattended-Upgrade "1";

One more fundamental recommendation is to enable only security updates because usual updates may lead to the app going down during the updates and that is not an ideal variant for most of the cases.

vim /etc/apt/apt.conf.d/50unattended-upgrades

Make some changes to the file as follows:

Unattended-Upgrade::Allowed-Origins {

    "${distro_id}:${distro_codename}";

    "${distro_id}:${distro_codename}-security";

    "${distro_id}:${distro_codename}-updates";

    "${distro_id}:${distro_codename}-backports";

};

Implementing Fail2Ban

Implementation of Fail2Ban is an awesome choice that will block lots of suspicious acts. This package functions by adding rules to iptables and banning suspicious IPs that show some strange activity.

The package uses some helpful filtering protocols and offers a great integration with other services to guarantee better protection against brute-force or DDoS attacks. You should regularly check the Fail2Ban, because it might block some real users. To simplify the process, you can integrate the tool with SendMail and you will be immediately notified once a certain IP is banned.

For the installation use:

apt-get install fail2ban

Enabling Two-Factor Authentication

If you want to have a fully secured server with fewer risks and possibilities of virtual attacks, then two-factor authentication is a must. The process of accessing your server makes so much more challenging because hackers will need to:

• Access VPN by getting the key/certificate
• Access your machine to get the private key
• Somehow get passphrase
• Lastly, access to your phone is required for 2-factor Authentication

Even if that becomes possible, they should get root access via sudo for these hackers should somehow get deploy’s PW that is encrypted and that is a huge challenge.

For the installation use:

apt-get install libpam-google-authenticator

To set up, you will need the following commands:

su deploy

google-authenticator

Setting Up Logwatch

Logwatch is one more helpful tool that is necessary for the checking of the logfiles. Daily, you will be receiving data about all the attempts that occurred during this period so you will have a clear picture of what is going on with your server. This might be used as a tool for monitoring and installation is so easy:

apt-get install logwatch

Then add the job:

vim /etc/cron.daily/00logwatch

Add the next line to the opened file:

/usr/sbin/logwatch --output mail --mailto admin@example.com --detail high

Finalizing the Setup

Here is all you need to know about the security of your Ubuntu server. Just by following our practical recommendations, you can significantly minimize virtual attacks on your system. If you want to go even further, you also need to check other possible vulnerabilities that are connected to the service and your apps. However, this is totally another topic to cover!